FCA paper on AI in financial services: good practice and areas for improvement

What has been published?

A paper setting out examples of good and poor practice for firms using AI, drawing on the FCA’s supervisory work, industry engagement and AI Lab initiatives. This is not a consultation, rule change or new prescribed AI governance framework. Instead, it illustrates how the FCA expects firms to apply the existing regulatory framework to AI in practice, and these may become reference points in supervisory engagement. 

Who is affected?

FCA-regulated firms that develop, procure, deploy or use AI in their regulated business or wider operations, including banks, fund managers, wealth management firms, investment firms and asset managers. The examples span a range of financial services firms and use cases, and their relevance will depend on the nature, scale and potential impact of the particular AI use.

Key messages

The FCA does not expect firms to build an entirely separate compliance framework for AI. Instead, firms should adapt existing governance and controls to address AI-specific risks, including by monitoring real-world outcomes, ensuring human oversight is effective, establishing clear business and senior management accountability, and managing risks arising from third-party providers and changes to AI systems. The direction of travel is also increasingly towards agentic AI and more autonomous systems. The FCA’s 2024 AI update did not address agentic AI but it is now expressly focusing on this development and has emphasised the importance of clear accountability and planning for failure as AI becomes increasingly autonomous.

Key dates

• 19 October 2026 - The FCA published its examples of good and poor practice. There is no consultation deadline, commencement date or formal implementation period, as the publication does not introduce new rules. However, it illustrates how the FCA expects firms to apply the existing regulatory framework to AI. Firms should therefore take the examples into account now when developing, deploying and overseeing AI, and should expect them to inform the FCA’s supervisory engagement from this point onwards.
• 18 March 2027 - FCA incident and third-party reporting – New FCA incident and third-party reporting requirements take effect. Firms should ensure that relevant AI-related incidents and dependencies are appropriately captured within their incident and third-party reporting arrangements.

Firms should review their material AI use cases against their existing governance, model risk management, systems and controls, SM&CR and third-party risk frameworks, and identify where those arrangements need to be adapted for AI. Priority should be given to higher-impact, less explainable or more autonomous applications, rather than creating a parallel AI compliance regime.

The FCA continues to apply its existing, technology-neutral regulatory framework to AI, including PRIN, SYSC, SM&CR and applicable outsourcing and operational resilience requirements. The publication also addresses the Consumer Duty, although many of those examples are more relevant to retail use cases than wholesale business. Importantly, the FCA makes clear that its examples are illustrative and non-exhaustive and do not create new regulatory obligations.

As we discussed in our May 2026 publication, “AI in UK financial services”, there remains an important distinction between the PRA’s express model risk management expectations under SS1/23, for firms within its scope, and the less prescriptive framework applicable to FCA-only firms. The FCA’s latest publication does not introduce an equivalent to SS1/23 or a standalone AI governance regime. What it does provide, however, is considerably more practical detail on the FCA’s supervisory expectations and, in particular, what good and poor practice can look like when firms apply the existing regulatory framework to AI.

That makes the publication significant in practice: firms now have a clearer supervisory benchmark against which to assess their own AI governance and controls, including as AI use becomes more sophisticated and autonomous.

•    Existing model frameworks can be used, but may need adaptation
The FCA expressly recognises that firms can build on existing model risk management and third-party risk frameworks, supplemented by targeted AI-specific controls. Its concern is with governance that is too generic, static or retrospective to address the risks of individual AI use cases.

For wholesale firms, a key question is therefore whether existing model inventories, risk classification, validation and third-party oversight adequately capture newer forms of AI, including externally supplied foundation models, AI embedded in third-party products and increasingly autonomous or agentic applications.

This does not mean treating every AI tool as if it were a material trading or risk model. Controls should remain proportionate to the nature, scale and potential impact of the use case, but firms should be able to demonstrate why their existing framework is appropriate and where AI-specific adaptations are needed.

•    Validation is not a one-off event
The FCA’s focus extends beyond pre-deployment testing and approval to ongoing monitoring of how AI performs in practice. Firms should monitor live outcomes, including drift and unexpected outputs, and have clear thresholds for escalation where performance or outcomes fall outside expectations.
For wholesale firms using AI in areas such as research, trade support, surveillance or risk management, monitoring should consider not only technical performance but also the resulting business consequences. This includes whether an AI system produces misleading analysis or erroneous recommendations, fails to identify relevant alerts, or takes or prompts inappropriate actions.

A recurring distinction is between firms having governance frameworks and being able to demonstrate that those frameworks work in practice. The FCA criticises firms that focus on technical performance metrics without assessing real-world outcomes, or that treat governance as a one-off approval exercise. This arguably marks an important practical distinction for firms with established model risk management frameworks: conventional model validation may not be sufficient where the behaviour and outputs of generative AI evolve or vary in production. Monitoring will need to be tailored to the actual use case and the potential consequences of erroneous outputs

•    Human-in-the-loop is not, by itself, an effective control
The FCA makes clear that human oversight is only effective where the human is genuinely able to challenge and intervene, highlighting the risks of automation bias and review becoming a box-ticking exercise. Firms should consider which AI-supported decisions require independent review, what information reviewers need to exercise meaningful judgement, and whether they have the expertise, authority and practical ability to challenge or override the AI output.

The level of human oversight should be proportionate to the risk and potential impact of the particular decision. Firms should also be able to evidence that meaningful review and challenge is taking place in practice, rather than relying on the presence of a human reviewer as a control in itself. 

•    Business ownership and technical ownership are both important
The FCA is not prescribing the establishment of a dedicated AI committee or a standalone AI risk management function. Nor does the FCA expect senior managers to be AI specialists, but it does expect informed oversight, clear accountability and reasonable steps, with mapping of AI responsibilities across senior management functions and appropriate training and documented governance processes. Technical ownership of an AI system is therefore not a substitute for accountability within the business area responsible for its use and outcomes.

For firms relying on central technology functions, group-wide systems or global AI platforms, responsibilities at the local level should remain clear. This includes identifying who within the business owns the use case, the respective roles of risk and compliance, and clear escalation routes where issues arise.

•    Provider changes and agentic AI require specific attention
Where firms rely on third-party AI, initial due diligence is unlikely to be sufficient on its own, particularly where the provider can update, replace or retire the underlying model. Depending on the significance of the use case, firms should consider appropriate contractual notification requirements, change testing and ongoing monitoring, as well as substitution and exit arrangements. This is particularly relevant where firms are reliant on a small number of foundation model providers. The FCA’s emphasis on substitutability and viable fallback arrangements may be difficult to achieve in practice, and contractual rights alone will not necessarily resolve that dependency.

Agentic AI introduces an additional dimension because the system may be capable of taking actions, rather than simply generating outputs. Firms should understand and control what systems and data an agent can access, what actions it is permitted to take and the circumstances in which human intervention is required, including how its activity can be restricted or stopped.

•    Model perimeter: Firms will need to determine which AI models, tools and workflows should fall within their existing model risk framework, and which are more appropriately managed through technology, conduct, operational or other risk frameworks. The answer may differ depending on the nature and significance of the use case.

•    Regulatory divergence: PRA SS1/23 applies only within its defined scope. FCA-only firms should not treat the FCA’s new examples as importing the PRA’s model risk framework fully. They should instead consider what the FCA’s examples mean for the application of their existing regulatory obligations to AI.

•    Markets-specific application: Many of the FCA’s more detailed examples focus on retail use cases. For wholesale firms, the appropriate controls for uses such as algorithmic trading, investment and research processes, risk management or market surveillance will need to reflect the particular activity, its risks and the regulatory obligations already applying to it. Controls should be assessed by reference to the underlying risk: for example, inaccurate or misleading information informing trading decisions, inappropriate trading behaviour, failures to identify potential market abuse or errors affecting risk exposures.

•    Proportionality: The FCA recognises that firms can build on existing governance frameworks and apply differentiated controls according to risk. The objective is effective governance and risk management, not additional committees or documentation for their own sake.